CVE-2026-25140 Chainguard apko Supply Chain Vulnerability
BLUF
Apko v0.14.8 → < v1.1.1 can be forced into disk/CPU exhaustion if it pulls packages from an attacker-controlled or compromised APK repository; a tiny, highly-compressed .apk can inflate into an enormous tar stream during expansion, causing CI/CD build failures / denial of service. Fixed in apko v1.1.1.
Executive Cost Summary
This cost analysis was developed by the CyberDax team using expert judgment and assisted analytical tools to support clarity and consistency.
For organizations affected by supply-chain-driven CI/CD denial-of-service via malicious APK repositories targeting apko builds:
· Low-end total cost: $300,000 – $700,000
o (Isolated CI runners, rapid patching, minimal release delays)
· Typical expected range: $700,000 – $1.8M
o (Multiple failed pipelines, short-term delivery disruption, moderate SLA exposure)
· Upper-bound realistic scenarios: $1.8M – $3.5M
o (Widespread build outages, repeated failures, customer-facing availability impact)
Key Cost Drivers
· Scale and concurrency of affected CI/CD pipelines
· Duration of build environment unavailability
· Reliance on third-party or mirrored APK repositories
· Release timing sensitivity tied to revenue or contractual milestones
· Strength of existing resource caps and build isolation controls
Potential affected sectors
· Software / SaaS & DevOps orgs using CI/CD container build pipelines
· Cloud & MSPs building Alpine-based images at scale
· Any org consuming third-party / mirrored / private APK repos in automated builds
Potential impacted countries
· Germany
· France
· United Kingdom
· Netherlands
· Sweden
· Finland
Date of first reported activity
· February 3, 2026
Date of last reported activity update
· February 5, 2026
Tools used in campaign
· Malicious/compromised APK repository infrastructure serving crafted .apk
· apko running in build systems (CI runners, build hosts)
TTPs
· T1195.001 Supply Chain Compromise Compromise Software Dependencies and Development Tools
o The primary attack vector involves an adversary compromising or controlling an APK repository used by the apko build tool.
· T1204.002 User Execution: Malicious File
o Exploitation occurs when a user or automated CI/CD pipeline fetches and attempts to expand a maliciously crafted, highly compressed .apk file (a "zip bomb").
· T1499.003 Endpoint Denial of Service: OS Exhaustion
o The vulnerability allows an attacker to cause resource exhaustion (disk space and CPU) on the build host, leading to build failures or total denial of service.
· T1584.002 Compromise Infrastructure DNS Server / Repositories
o Adversaries may compromise legitimate repository infrastructure or set up typosquatted mirrors to deliver the malicious payload to apko users.
CVSS:3.1
· (7.5) /AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (Base 7.5 HIGH)
Nessus ID
· There have been no Tenable plugin IDs associated with CVE-2026-25140 at this time.
Is this on the CISA KEV list?
· CVE-2026-25140 is not in the CISA KEV catalog at this time.
Patching / mitigation
· Repository trust controls (defense-in-depth):
· Use only trusted/approved APK repos, avoid unvetted mirrors
· Enforce repo integrity / signing validation whre applicable and avoid disabling signature checks in pipelines (risk increases when signature verification is bypassed).
· Build-host hardening:
· Put CI builders in resource-capped sandboxes (disk quotas, CPU limits), use ephemeral runners, monitor abnormal decompression/output growth
Patch release date
· February 3, 2026
URL link(s) to patch information
· hxxps://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6
· hxxps://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09
Malware names
· CVE-2026-25140 has not been associated with malware at this time.
Malware family
· CVE-2026-25140 has not been associated with malware at this time.
sha256
· CVE-2026-25140 has not been associated with malware at this time.
Known decoding key
· CVE-2026-25140 has not been associated with malware at this time.
Verdict
· High impact to availability for organizations relying on apko in automated container builds; supply-chain precondition (repo control/compromise) is the key risk driver; patch is straightforward (upgrade to v1.1.1+).
Primary objectives
· Disrupt CI/CD and delivery (DoS)
· Potentially increase operational cost / induce outages by exhausting build resources
APT Groups
· CVE-2026-25140 has not been associated with an APT group at this time.
Criminal organizations
· CVE-2026-25140 has not been associated with a criminal organization at this time.
Behavior analysis
· Sudden spikes in disk writes to temp/build directories during .apk expansion
· CPU pegging during decompression/unpacking
· Build failures
· Timeouts
Network side
· Builds fetching .apk from a repo endpoint, potentially with unusually small compressed size vs very large expanded output
Suggested rules / potential hunts
As a reminder, these are indicator rules. They are likely to be noisy.
For best results consider creating a data model and reviewing the traffic as a report.
Suricata
Flag CI/build hosts downloading APK packages from non-approved repositories
alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"POSSIBLE apko/APK repo fetch (review repo allowlist) - CVE-2026-25140 hunt";
flow:established,to_server;
http.method; content:"GET"; nocase;
http.uri; pcre:"/\.apk(\?|$)/Ui";
classtype:policy-violation;
sid:202625140; rev:1;
)
Flag suspiciously large APK downloads
alert http $HOME_NET any -> $EXTERNAL_NET any (
msg:"Large .apk download (possible decompression bomb precursor) - CVE-2026-25140 hunt";
flow:established,to_client;
fileext:"apk";
dsize:>20000000;
classtype:attempted-dos;
sid:202625141; rev:1;
)
SentinelOne
Apko process with abnormal child activity / heavy writes
EventType = "Process" AND (ProcessName = "apko" OR ImagePath endswith "\\apko" OR ImagePath endswith "/apko")
Apko followed by very high-volume file writes in temp/work dirs (common CI paths shown; customize)
(EventType = "File" AND Action = "Write") AND
(ParentProcessName = "apko" OR InitiatingProcessName = "apko") AND
(FilePath contains "/tmp/" OR FilePath contains "/var/tmp/" OR FilePath contains "/workspace/" OR FilePath contains "/runner/_work/")
Apko network connections to non-allowlisted domains
EventType = "Network" AND (InitiatingProcessName = "apko" OR ParentProcessName = "apko")
Splunk
Find apko executions and correlate to build failures / resource issues
index=endpoint (process_name=apko OR Image="*\\apko.exe" OR process="*apko*")
| stats count min(_time) as first_seen max(_time) as last_seen values(user) values(host) values(command_line) by host
| convert ctime(first_seen) ctime(last_seen)
Hunt for “no space left on device” / decompression-related failures around apko runs
index=ci_logs ("apko" AND ("no space left on device" OR "resource temporarily unavailable" OR "killed" OR "out of memory" OR "failed to unpack" OR "tar"))
| stats count min(_time) as first_seen max(_time) as last_seen values(job_id) values(repo) by host
| convert ctime(first_seen) ctime(last_seen)
Identify new/unapproved APK repo domains contacted by build infrastructure
index=proxy OR index=dns
(build_host=true OR tag=ci)
| search (uri="*.apk*" OR query="*.apk*")
| stats count dc(dest_host) as uniq_domains values(dest_host) by src_host
| sort - count
Delivery methods
· Compromised/malicious APK repository used by apko
· Repo mirror poisoning (typosquatted mirror, misconfigured internal proxy/cache)
· Man-in-the-middle on repo traffic (when TLS/pinning/validation is weak)
References
NVD
· hxxps://nvd.nist.gov/vuln/detail/CVE-2026-25140
Radar OffSeq
· hxxps://radar.offseq.com/threat/cve-2026-25140-cwe-400-uncontrolled-resource-consu-960ed904
Github
· hxxps://github.com/chainguard-dev/apko/security/advisories/GHSA-f4w5-5xv9-85f6
· hxxps://github.com/chainguard-dev/apko/commit/2be3903fe194ad46351840f0569b35f5ac965f09
